Assurance Retraite data breach: 70K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-10-20
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account. Exposed data: dates of birth, email addresses, family members' names, government issued ids, income levels, marital statuses, names, phone numbers, physical addresses. The breach dates from Sep 1, 2024; Have I Been Pwned loaded it on Oct 20, 2026.
What to do
- If you had a Assurance Retraite account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
